Daily Digest

Massive Data Breaches, Android Zero-Days, and APT Activity Mark a Turbulent Start to December

Massive Data Breaches, Android Zero-Days, and APT Activity Mark a Turbulent Start to December

December 2, 2025
7 articles (7 new)
21 min read

Summary

This cybersecurity brief for December 2, 2025, covers a series of high-impact incidents. Key stories include a supply chain attack on the popular SmartTube app for Android TV, a monumental data breach at South Korean e-commerce giant Coupang affecting 33.7 million users, and Google's emergency patch for two actively exploited Android zero-day vulnerabilities. Additionally, law enforcement dismantled a major crypto-laundering service, and new campaigns from Iranian and North Korean APT groups targeting critical infrastructure and financial sectors have been detailed.

Filter by Category

New Articles (7)

SmartTube App Compromised: Malicious Update Pushed via Stolen Keys

HIGH

Popular YouTube Client 'SmartTube' Suffers Supply Chain Attack After Developer's Signing Keys Stolen

A significant supply chain attack has compromised the popular ad-free YouTube client for Android TV, SmartTube. An attacker stole the developer's signing keys and distributed a malicious update containing surveillance-style malware through official channels. The malware, hidden in versions 30.43 through 30.55, collected device information and sent it to a command-and-control server. In response, Google Play Protect began automatically disabling the app on user devices. The developer has since revoked the compromised keys and released a new, clean version, which requires all users to perform a manual reinstallation to ensure their security.

December 2, 2025
5 min read
Android TVsigning keyssupply chainmalwareopen source +1 more
SmartTube App Compromised: Malicious Update Pushed via Stolen Keys
Supply Chain Attack
Malware
Mobile Security

'Cryptomixer' Shut Down: Authorities Seize €25M in Bitcoin from Laundering Service

HIGH

Europol and Partners Dismantle 'Cryptomixer.io' Used to Launder Over €1.3 Billion

A coordinated international law enforcement action, codenamed "Operation Olympia," has successfully dismantled Cryptomixer.io, a major cryptocurrency mixing service. Led by Swiss and German authorities with significant support from Europol and Eurojust, the takedown resulted in the seizure of servers, 12 terabytes of data, and over €25 million in Bitcoin. The service, active since 2016, is believed to have laundered over €1.3 billion for a wide range of criminal groups, including ransomware gangs and the North Korean Lazarus Group, by obfuscating the trail of illicit funds.

December 2, 2025
4 min read
cryptocurrencymoney launderingtakedownEuropolBitcoin +1 more
'Cryptomixer' Shut Down: Authorities Seize €25M in Bitcoin from Laundering Service
Policy and Compliance
Cyberattack
Threat Actor

Iran-Linked MuddyWater APT Targets Israel with New 'MuddyViper' Backdoor

HIGH

MuddyWater APT Campaign Deploys New 'MuddyViper' Backdoor Against Critical Infrastructure in Israel and Egypt

The Iranian-affiliated APT group MuddyWater has been observed in a new cyberespionage campaign targeting critical infrastructure and other key sectors in Israel and Egypt. Active from late 2024 to early 2025, the campaign leverages a previously undocumented custom C/C++ backdoor named MuddyViper. The malware is delivered via a loader called Fooder, which in some cases was disguised as the classic Snake game to deceive victims. The group, also known as Mango Sandstorm, used the backdoor for espionage, credential theft, and remote command execution, and showed operational overlap with another Iranian group, Lyceum.

December 2, 2025
6 min read
MuddyWaterIranAPTespionageMuddyViper +2 more
Iran-Linked MuddyWater APT Targets Israel with New 'MuddyViper' Backdoor
Threat Actor
Malware
Cyberattack

Lazarus APT's Remote IT Worker Infiltration Scheme Exposed in Real-Time

HIGH

Researchers Capture North Korea's Lazarus Group Operatives Posing as Remote IT Workers

A joint investigation by security researchers has exposed the inner workings of a North Korean Lazarus Group scheme where operatives commit identity fraud to get hired as remote IT workers at Western firms. By luring the threat actors into a sophisticated honeypot environment, researchers from BCA LTD, NorthScan, and ANY.RUN were able to capture their tactics, techniques, and procedures (TTPs) in real-time. The scheme's goals are twofold: to gain persistent network access for espionage and to funnel salaries back to the Democratic People's Republic of Korea (DPRK) in violation of international sanctions.

December 2, 2025
6 min read
Lazarus GroupNorth Koreasocial engineeringidentity fraudremote work +1 more
Lazarus APT's Remote IT Worker Infiltration Scheme Exposed in Real-Time
Threat Actor
Phishing
Security Operations

India Backs Down on Mandatory Pre-Installed Government "Snooping App"

INFORMATIONAL

Indian Government Revokes Controversial Order for Pre-installing 'Sanchar Saathi' App on Smartphones

Following widespread criticism from privacy advocates and significant resistance from major tech companies, the Indian government has withdrawn a controversial directive that would have required smartphone makers like Apple and Samsung to pre-install a non-deletable, state-owned security app. The app, named "Sanchar Saathi," was labeled a potential "snooping app" by critics, who raised concerns that it could be used as a tool for mass surveillance, violating citizens' right to privacy. The swift reversal marks a notable event in the ongoing global debate over digital privacy and government authority.

December 2, 2025
4 min read
IndiaprivacysurveillancegovernmentApple +2 more
India Backs Down on Mandatory Pre-Installed Government "Snooping App"
Policy and Compliance
Regulatory
Mobile Security

AI Cybersecurity Firm Tenex Expands to EMEA with New Funding

INFORMATIONAL

Sarasota-Based Tenex Announces EMEA Expansion Backed by DTCP Investment

AI-native cybersecurity firm Tenex announced its expansion into the Europe, Middle East, and Africa (EMEA) region on December 2, 2025. The strategic move is supported by a new Series A investment from the global investment firm DTCP. Tenex, which offers an AI-driven managed detection and response (MDR) service, has seen rapid growth since its founding in January 2025 and plans to establish an international headquarters in Europe in 2026 to capitalize on the region's demand and talent pool.

December 2, 2025
2 min read
AIMDRcybersecurity industryfundingEMEA +1 more
AI Cybersecurity Firm Tenex Expands to EMEA with New Funding
Other
Security Operations

CrowdStrike Named AWS Global Security and Marketplace Partner of the Year

INFORMATIONAL

CrowdStrike Recognized as AWS 2025 Global Security and Marketplace Partner of the Year at re:Invent

At the AWS re:Invent 2025 conference, cybersecurity leader CrowdStrike was named both the Amazon Web Services (AWS) 2025 Global Security Partner of the Year and the Global Marketplace Partner of the Year. This dual recognition follows a landmark achievement for CrowdStrike, which became the first cloud-native independent software vendor (ISV) to surpass $1 billion in sales through the AWS Marketplace within a single calendar year, underscoring the strength of its cloud security offerings and its partnership with AWS.

December 2, 2025
3 min read
CrowdStrikeAWSre:Inventcloud securityMarketplace +1 more
CrowdStrike Named AWS Global Security and Marketplace Partner of the Year
Cloud Security
Other

📢 Share This Publication

Help others stay informed about cybersecurity threats